Privacy Policy & Data Protection Notice
Effective Date: September 15, 2026 · Last Updated: September 15, 2026
The EmailScore Privacy Guarantee in Brief:
- We do not store or persist verified email addresses. All mailbox and domain evaluation happens transiently in volatile memory (<0.3ms) and is immediately discarded.
- We do not sell, rent, or enrich third-party databases with your email lists.
- We act strictly as a Data Processor for the emails you submit for scoring under GDPR and CCPA.
1. Information We Collect
Account & Billing Information: When you register an account or subscribe to our Service, we collect your email address, hashed passwords, and authentication tokens. Payment details (credit card numbers and billing addresses) are handled directly by our certified payment processor (Stripe) and are never stored on EmailScore servers.
API Telemetry & Aggregate Usage: To prevent abuse, enforce rate limits, and calculate monthly invoice overages, we log aggregated metadata (such as timestamps, request counts, response latency, and HTTP status codes).
2. Processing of Verification Queries (Stateless Engine)
When you submit an email address to our API (/v1/check or bulk endpoints), the query payload is processed in-memory:
- The email address is decomposed into local-part and domain components for statistical analysis (Markov transition probability, Shannon entropy, and MX record probing).
- Once the scoring payload is returned to your client, the email address string is permanently cleared from volatile memory.
- No email address submitted for scoring is ever written to persistent disk storage, databases, or third-party loggers.
3. Data Controller vs. Data Processor (GDPR / UK GDPR)
Under the General Data Protection Regulation (GDPR) and UK GDPR:
- Customer is the Data Controller: You control the customer lists you submit and determine the lawful basis (e.g., explicit consent or legitimate interest) for processing those email addresses.
- EmailScore is the Data Processor: We process emails strictly on your instructions and in accordance with these data protection terms.
4. Security Safeguards
All API interactions, web sessions, and database connections are encrypted using industry-standard Transport Layer Security (TLS 1.3). Access to API endpoints requires cryptographic API key authentication.
5. Data Retention
We retain your account profile (email, API key metadata, billing records) for as long as your account remains active. Because submitted verification queries are stateless, there is zero retention of query payloads.
6. Your Rights
Depending on your jurisdiction (e.g., GDPR, CCPA/CPRA), you have the right to access, rectify, or request deletion of your account data. You may request account deletion at any time by contacting our privacy officer.
7. Contact Information
If you have questions or concerns about this Privacy Policy, please contact our Data Protection Officer at: [email protected].